pat-s
1ad7a6bfe9
Some checks failed
ci/crow/cron/process-updates/13 Pipeline was successful
ci/crow/cron/process-updates/15 Pipeline was successful
ci/crow/cron/process-updates/10 Pipeline was successful
ci/crow/cron/process-updates/4 Pipeline was successful
ci/crow/cron/process-updates/16 Pipeline was successful
ci/crow/cron/process-updates/14 Pipeline was successful
ci/crow/cron/process-updates/11 Pipeline was successful
ci/crow/cron/process-updates/12 Pipeline was successful
ci/crow/cron/process-updates/17 Pipeline was successful
ci/crow/cron/process-updates/18 Pipeline was successful
ci/crow/cron/process-updates/6 Pipeline was successful
ci/crow/cron/process-updates/5 Pipeline was successful
ci/crow/cron/process-updates/1 Pipeline was successful
ci/crow/cron/process-updates/2 Pipeline was successful
ci/crow/cron/process-updates/3 Pipeline failed
ci/crow/cron/process-updates/9 Pipeline failed
ci/crow/cron/process-updates/7 Pipeline failed
ci/crow/cron/process-updates/8 Pipeline failed
ci/crow/manual/build-all-versions-install-deps/2 Pipeline was successful
ci/crow/manual/build-all-versions/5 Pipeline failed
ci/crow/manual/build-all-versions/7 Pipeline failed
ci/crow/manual/build-all-versions/6 Pipeline failed
ci/crow/manual/build-all-versions/8 Pipeline was canceled
## Summary
Stop hardcoding the bincraft version. Every `.crow` workflow and the build-one image pinned `@vX.Y.Z` (and a `packageVersion() != "X.Y.Z"` guard), so each bincraft release meant editing the version in ~8 places — and it was easy to miss one (the Dockerfile lagged at v4.2.1; v4.4.1 shipped without the empty-env fix because of exactly this churn).
## Change
New `local/install-bincraft.R` resolves the **latest release tag dynamically**:
- `git ls-remote --tags` on the public repo (no token),
- keep `vX.Y.Z` tags, pick the highest version (filtered/sorted in R for portability, not via git `--sort`/refspec which behaved inconsistently under `system2()`),
- `pak::pak("git::…@<latest>")` — idempotent on the git ref, so re-runs keep the package unless a newer tag exists.
All call sites now invoke the helper instead of a pinned version:
- `.crow/build-all-versions.yaml` (primary + per-minor pass)
- `.crow/build-all-versions-install-deps.yaml`
- `.crow/process-updates.yaml` (primary + per-minor pass)
- `.crow/weekly-rebuild-missing.yaml`
- `.crow/archive-missed-packages.yaml`
- `docker/build-one.Dockerfile` (ships the helper into the image; `ensure_bincraft` sources it)
## Effect
Tag a new bincraft release → the next CI run / `just rebuild` picks it up automatically. No more pin edits, and no more "forgot to bump the Dockerfile" drift.
## Verified
- Resolver returns the current latest tag (`v4.4.2`) via `git ls-remote` + R-side version sort.
- All five workflow YAMLs parse; helper R parses; air/editorconfig clean.
Note: this tracks the latest **tag**, so cutting a release is still the deliberate gate — CI won't pick up un-tagged main.
Reviewed-on: #107
73 lines
3.4 KiB
Docker
73 lines
3.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Targeted (re)build of specific package versions, executed on a remote buildx
|
|
# builder. The build's effect is the S3 upload performed by build-one.R; no
|
|
# image is kept (the justfile uses --output type=cacheonly). CACHEBUST forces
|
|
# the RUN to re-execute on every invocation.
|
|
#
|
|
# Build context is `local/` (see the `rebuild` recipe in the justfile).
|
|
ARG OS
|
|
ARG OS_VERSION
|
|
FROM reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}
|
|
|
|
ARG R_VERSION=4.5.3
|
|
ARG PACKAGE
|
|
ARG VERSIONS
|
|
ARG CACHEBUST
|
|
|
|
WORKDIR /work
|
|
COPY build-one.R /work/build-one.R
|
|
# Resolve and install the latest bincraft release dynamically (no hardcoded pin).
|
|
COPY install-bincraft.R /work/install-bincraft.R
|
|
# Ship the patch registry so build-one.R's `patches = "local/patches"` resolves
|
|
# (build context is `local/`, CWD is /work).
|
|
COPY patches /work/local/patches
|
|
|
|
RUN --mount=type=secret,id=b2_access,required=true \
|
|
--mount=type=secret,id=b2_secret,required=true \
|
|
--mount=type=secret,id=pgpass,required=true \
|
|
--mount=type=secret,id=github_pat,required=false \
|
|
export B2_S3_ACCESS_KEY="$(cat /run/secrets/b2_access)" && \
|
|
export B2_S3_SECRET_KEY="$(cat /run/secrets/b2_secret)" && \
|
|
export PGPASS="$(cat /run/secrets/pgpass)" && \
|
|
export GITHUB_PAT="$(cat /run/secrets/github_pat 2>/dev/null || true)" && \
|
|
export GIT_TERMINAL_PROMPT=0 && \
|
|
export OTEL_SDK_DISABLED=true && \
|
|
export OTEL_R_TRACES_EXPORTER=none && \
|
|
export OTEL_R_LOGS_EXPORTER=none && \
|
|
export OTEL_R_METRICS_EXPORTER=none && \
|
|
XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run || true); \
|
|
XVFB_ARGS=""; \
|
|
if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi; \
|
|
USE_XVFB=0; \
|
|
if [ -n "$XVFB" ] && $XVFB -a $XVFB_ARGS -- true >/dev/null 2>&1; then \
|
|
USE_XVFB=1; echo "Using virtual display via $XVFB"; \
|
|
else \
|
|
echo "No working virtual display; building without xvfb" >&2; \
|
|
fi; \
|
|
run_build() { if [ "$USE_XVFB" = 1 ]; then $XVFB -a $XVFB_ARGS -- "$@"; else "$@"; fi; }; \
|
|
ensure_bincraft() { "$1" -q -e 'source("/work/install-bincraft.R")'; }; \
|
|
PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2); \
|
|
seen=" $PRIMARY_MINOR "; \
|
|
prc=0; failed=""; \
|
|
rm -f .r_minor_sensitive; \
|
|
echo "=== primary pass under R $R_VERSION ==="; \
|
|
ensure_bincraft /opt/R/${R_VERSION}/bin/R; \
|
|
run_build /opt/R/${R_VERSION}/bin/Rscript /work/build-one.R "${PACKAGE}" ${VERSIONS} || prc=$?; \
|
|
if [ -f .r_minor_sensitive ]; then \
|
|
for RBIN in /opt/R/*/bin/Rscript; do \
|
|
[ -x "$RBIN" ] || continue; \
|
|
RV=$(basename "$(dirname "$(dirname "$RBIN")")"); \
|
|
case "$RV" in [0-9]*) ;; *) continue ;; esac; \
|
|
RMINOR=$(echo "$RV" | cut -d. -f1-2); \
|
|
case "$seen" in *" $RMINOR "*) continue ;; esac; \
|
|
seen="$seen$RMINOR "; \
|
|
echo "=== sensitive-only pass under R $RV ==="; \
|
|
ensure_bincraft "$(dirname "$RBIN")/R"; \
|
|
run_build "$RBIN" /work/build-one.R --sensitive-only "${PACKAGE}" ${VERSIONS} || failed="$failed $RV"; \
|
|
done; \
|
|
else \
|
|
echo "Package not r-minor-sensitive; skipping per-minor passes."; \
|
|
fi; \
|
|
if [ -n "$failed" ]; then echo "WARNING: extra-minor build(s) failed (non-fatal; e.g. a version too old to compile on a newer R):$failed" >&2; fi; \
|
|
if [ "$prc" != 0 ]; then echo "primary pass under R $R_VERSION failed (exit $prc)" >&2; fi; \
|
|
exit "$prc"
|